From 7b0c070bba40d5a6d74f5c21e4054e7e306489c6 Mon Sep 17 00:00:00 2001 From: "lockfile-maintenance[bot]" <331761537+lockfile-maintenance[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 02:42:07 +0000 Subject: [PATCH 1/2] Maintain lockfiles with a minimum release age --- Cargo.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index def0dd6..18a4c6e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -130,7 +130,7 @@ dependencies = [ "heck", "proc-macro2", "quote", - "syn 3.0.6", + "syn 3.0.9", ] [[package]] @@ -406,9 +406,9 @@ dependencies = [ [[package]] name = "syn" -version = "3.0.6" +version = "3.0.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee" +checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b" dependencies = [ "proc-macro2", "quote", @@ -468,9 +468,9 @@ dependencies = [ [[package]] name = "unicode-ident" -version = "1.0.26" +version = "1.0.27" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954" +checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563" [[package]] name = "unicode-segmentation" From fd7c8dbaf5dcac4eed32e7a10dd14ad987d82552 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 09:36:51 +0000 Subject: [PATCH 2/2] Update github actions --- .github/workflows/ci.yml | 32 +++++++++++----------- .github/workflows/lockfile-maintenance.yml | 4 +-- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f97ac57..d17dbac 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -51,7 +51,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -70,7 +70,7 @@ jobs: sh - name: Cache dist - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: cargo-dist-cache path: ~/.cargo/bin/dist @@ -87,7 +87,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Upload dist manifest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: artifacts-plan-dist-manifest path: plan-dist-manifest.json @@ -112,7 +112,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -149,7 +149,7 @@ jobs: run: irm https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.ps1 | iex - name: Fetch local artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: target/distrib/ @@ -183,7 +183,7 @@ jobs: cp dist-manifest.json "$BUILD_MANIFEST_NAME" - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: artifacts-build-local-${{ join(matrix.targets, '_') }} path: | @@ -206,7 +206,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -218,7 +218,7 @@ jobs: submodules: recursive - name: Install cached dist - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: cargo-dist-cache path: ~/.cargo/bin/ @@ -227,7 +227,7 @@ jobs: run: chmod +x ~/.cargo/bin/dist - name: Fetch local artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: target/distrib/ @@ -247,7 +247,7 @@ jobs: cp dist-manifest.json "$BUILD_MANIFEST_NAME" - name: Upload artifacts - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: artifacts-build-global path: | @@ -271,7 +271,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -322,7 +322,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -334,7 +334,7 @@ jobs: submodules: recursive - name: Install cached dist - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: cargo-dist-cache path: ~/.cargo/bin/ @@ -343,7 +343,7 @@ jobs: run: chmod +x ~/.cargo/bin/dist - name: Fetch artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: target/distrib/ @@ -362,13 +362,13 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Upload dist manifest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: artifacts-dist-manifest path: dist-manifest.json - name: Download GitHub artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: artifacts-* path: artifacts diff --git a/.github/workflows/lockfile-maintenance.yml b/.github/workflows/lockfile-maintenance.yml index bd31bcd..0546752 100644 --- a/.github/workflows/lockfile-maintenance.yml +++ b/.github/workflows/lockfile-maintenance.yml @@ -21,12 +21,12 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Update lockfile and create a pull request - uses: knu/lockfile-maintenance-action@88c9463c4ac32a3b5d1a0ef2ce1caedab9bd80c3 # v2.1.0 + uses: knu/lockfile-maintenance-action@051d96d8e3b8e05234a66b6c2c8c76d30c1cf831 # v2.1.1 with: files: /Cargo.lock minimum-release-age: 3 days